I have to install a cert for an application running over IP address,, the application has to be accessed on Our integrating partner requested a CSR from me which I generated with OpenSSL for the IP address. He signed it and return a cert and chain. According to how I have been installing certs on nginx, i have to concatenate the Cert and the Intermediate then use it with the key I generated in order for the app to work with SSL.

Now I repeated the same thing, and I get this error

nginx: [emerg] PEM_read_bio_X509("/etc/ssl/") failed (SSL: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:Type=X509_CINF error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:Field=cert_info, Type=X509 error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib)
nginx: configuration file /etc/nginx/nginx.conf test failed
  • Using IP addresses in https:// URLs is not a good idea. – Patrick Mevzek Jun 12 at 16:38
  • Yes, But apparently this our Integrating partner want it, and the communication is even over VPN. – saviour123 Jun 12 at 16:53

That error message generally indicates a formatting error in the certificate file. You need to make sure all of your -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines are there, that there's no trailing white space after them or any piece of the certs, no unnecessary blank lines, etc.

It's likely something got messed up when you concatenated.

  • Indeed there was an issue with the cert because of text in it. This was visible after I decoded the cert from openssl pb7 to text-> pkcs7 -print_certs < chain_211.p7b > fullchain.crt – saviour123 Jun 11 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.